Uranus

Browser-native execution firewall and deterministic risk engine providing cryptographic human-in-the-loop authorization and SHA-256 audit ledgers for WebMCP AI agents.

Comment

Inspiration

Autonomous AI agents are rapidly evolving from read-only text generators into active execution engines capable of running browser-native tools via OpenAI's WebMCP standard (navigator.modelContext). However, granting an LLM direct execution bridges to deduct balances, trigger payouts, or mutate persistent state introduces severe security vulnerabilities:

  • Indirect Prompt Injections: Adversarial instructions hidden inside untrusted context (customer emails, scraped web pages, support tickets) can manipulate an agent into dispatching unauthorized funds.
  • Recursive Runaway Loops: Agent hallucinations and automated retry loops can drain corporate treasuries and API quotas within seconds.
  • Absence of Proof: Traditional web confirmation popups offer zero mathematical non-repudiation or cryptographic proof of human intent.

We named the project Uranus after the cold ice giant that rotates on a perpendicular 98-degree axial tilt. While traditional security attempts to police LLMs in-line using prompt instructions (which inevitably fail), Uranus operates perpendicular to the agent's reasoning loop. It acts as an absolute-zero execution freeze at the browser boundary, pausing unverified tool calls until they are cryptographically signed off by an authorized human operator.

What It Does

Uranus is a browser-native security proxy and deterministic execution firewall sitting between autonomous agents and state-mutating actions:

  • Multi-Transport Tool Interception: Registers execution tools (request_guarded_settlement, simulate_preflight) across navigator.modelContext (WebMCP), HTTP/WebSocket bridges, and stdio MCP runners.
  • Deterministic Risk Engine: Evaluates incoming payloads against strict monetary thresholds ($100 auto-approval cap), sliding-window velocity circuit breakers (blocking recursive loops), and recipient deny-lists.
  • True Network Back-Pressure: Holds the agent's execution promise pending across the network boundary until security checks pass or an operator resolves the interception card.
  • Cryptographic Human Authorization: High-risk actions require step-up approval where the human operator cryptographically signs the transaction payload using non-extractable keys in the browser via the Web Crypto API (window.crypto.subtle).
  • Immutable SHA-256 Audit Trail: Chains every resolution (Auto-Approved, Authorized, Rejected) into a sequential, tamper-evident hash ledger stored in IndexedDB.
  • Interactive Sandbox for Reviewers: Provides preloaded attack simulations alongside a custom settlement form, allowing judges to test arbitrary amounts, deny-listed recipients, or rapid clicks directly against the live policy engine with zero code.

How We Built It

  • Protocol Layer: Implemented using @modelcontextprotocol/sdk to conform strictly with OpenAI's WebMCP standard and MCP stdio specifications.
  • Frontend Architecture: Built with Next.js 15 (App Router), React 19, TypeScript, and Tailwind CSS.
  • Cryptography & Non-Repudiation: Implemented browser-native key generation, canonical payload hashing, and signature verification using the native Web Crypto API (window.crypto.subtle, ECDSA P-256, SHA-256).
  • Pluggable Settlement Adapter Interface: Built around an agnostic SettleInput -> SettleResult contract. Every layer above the ledger is production-grade security infrastructure; the execution backend is fully decoupled and can be swapped for Stripe, bank rails, or on-chain settlement with a simple adapter function.
  • State Management & Backend: Containerized Node.js bridge server managing an atomic, file-backed ledger with overdraft protection and real-time WebSocket state synchronization.
  • Infrastructure & Deployment: Next.js frontend deployed on Vercel; containerized backend bridge running live on Koyeb.

Challenges We Ran Into

  • True Network Promise Back-Pressure: Most human-in-the-loop safety demos fake control with client-side UI modals that an agent can trivially bypass. We engineered the agent's HTTP request to genuinely block across the network boundary until an operator resolves it. This required building an in-process pending promise hub on the bridge server to hold the response socket open, stream a pending event over WebSockets to the browser, and only release the execution response once the operator provides a signed resolve payload.
  • Cross-Runtime Cryptographic Determinism: The client signs payloads using non-extractable ECDSA P-256 keys in IndexedDB via window.crypto.subtle, while the Node.js bridge verifies signatures using server-side crypto primitives. Both environments had to generate byte-identical canonical JSON representations, as a single key-ordering shift or trailing whitespace character invalidates the digital signature. We also re-derived the operator's fingerprint from the server-side SPKI export to prevent client fingerprint spoofing.
  • Race Conditions in the Hash-Chained Audit Ledger: Early iterations suffered from concurrent write collisions: rapid authorizations could read the same chain-tail state from IndexedDB, generate conflicting previous_hash pointers, and orphan blocks. We resolved this by serializing every write through an atomic promise queue to guarantee sequential ledger integrity during high-frequency execution bursts.
  • Decoupled Hybrid Deployment Architecture: Uranus requires both an edge-rendered Next.js frontend and a persistent, stateful Node.js bridge server handling WebSockets and file-backed ledger state. Because serverless environments drop persistent socket connections, we decoupled the architecture: hosting the frontend on Vercel and the stateful containerized bridge microservice on Koyeb, synchronized via a unified environment bridge URL.

Accomplishments That We're Proud Of

  • Full OpenAI WebMCP Conformance: Successfully registering and intercepting live tools on navigator.modelContext.
  • Legitimate Cryptographic Rigor: Replacing cosmetic confirmation modals with true digital signatures and sequentially linked SHA-256 hash chains.
  • Frictionless Judge Sandbox: Providing an interactive settlement tester allowing anyone to probe velocity limits, spend thresholds, and injection vectors without running local terminal commands.
  • Clean Monochrome Visual Identity: Building an intentional, distraction-free control center designed specifically for security operators.

What We Learned

  • Standard client-side UI confirmation dialogs provide an illusion of safety; true agent defense requires network-level promise interception and mathematical non-repudiation.
  • In-browser execution via navigator.modelContext creates massive ergonomic gains for agentic workflows, but deterministic policy engines must sit between the model and the execution runtime to make it enterprise-safe.
  • Designing with the native Web Crypto API provides enterprise-grade key isolation directly inside standard browser runtimes without external hardware dependencies.

What's Next for Uranus

  • Out-of-Band Human Approval Channels: Push notifications and asynchronous Slack/Telegram approval webhooks for background server-side agent runs.
  • Hardware-Backed WebAuthn & Passkeys: Upgrading from browser-isolated Web Crypto keys to true hardware-enclave biometric sign-off (Touch ID / Face ID / YubiKey).
  • Multi-Signature Quorum Policies: Requiring M-of-N human signers for high-value organizational treasury mutations above configurable risk thresholds.
  • Dynamic Policy Engine: Zero-knowledge policy validation and real-time smart contract rule syncing across EVM and Solana networks.
  • TTL & Auto-Abort Handlers: Configurable time-to-live expiration policies for unattended agent step-up promises.
  • First-Party Production Payment Adapters: Shipping maintained, in-tree adapter modules (Stripe, Wise, Circle, on-chain smart contracts) so teams do not need to write their own integration wiring.

Built With

  • agent-security
  • ai-safety
  • cryptography
  • docker
  • ecdsa-p256
  • human-in-the-loop
  • indexeddb
  • koyeb
  • mcp
  • model-context-protocol
  • nextjs
  • node.js
  • openai-webmcp
  • passkeys
  • react
  • sha256
  • tailwindcss
  • typescript
  • vercel
  • web-crypto-api
  • webmcp
  • websocket
Share this project:

Updates